Apparatus, method and system for a tunneling client access point

ABSTRACT

The disclosure details the implementation of a tunneling client access point (TCAP) that is a highly secure, portable, power efficient storage and data processing device. The TCAP “tunnels” data through an access terminal&#39;s (AT) input/output facilities. In one embodiment, the TCAP connects to an AT and a user employs the AT&#39;s user input peripherals for input, and views the TCAP&#39;s activities on the AT&#39;s display. This enables the user to observe data stored on the TCAP without it being resident on the AT, which can be useful to maintain higher levels of data security. Also, the TCAP may tunnel data through an AT across a communications network to access remote servers. The disclosure also teaches a plug-n-play virtual private network (VPN).

FIELD

The present invention is directed generally to an apparatus, method, andsystem of accessing data, and more particularly, to an apparatus, methodand system to execute and process data by tunneling access through aterminal.

BACKGROUND Portable Computing and Storage

Computing devices have been becoming smaller over time. Currently, someof the smallest computing devices are in the form of personal digitalassistants (PDAs). Such devices usually come with a touch screen, aninput stylus and/or mini keyboard, and battery source. These devices,typically, have storage capacities around 64 MB. Examples of thesedevices include Palm's Palm Pilot.

Information Technology Systems

Typically, users, which may be people and/or other systems, engageinformation technology systems (e.g., commonly computers) to facilitateinformation processing. In turn, computers employ processors to processinformation; such processors are often referred to as central processingunits (CPU). A common form of processor is referred to as amicroprocessor. A computer operating system, which, typically, issoftware executed by CPU on a computer, enables and facilitates users toaccess and operate computer information technology and resources. Commonresources employed in information technology systems include: input andoutput mechanisms through which data may pass into and out of acomputer; memory storage into which data may be saved; and processors bywhich information may be processed. Often information technology systemsare used to collect data for later retrieval, analysis, andmanipulation, commonly, which is facilitated through database software.Information technology systems provide interfaces that allow users toaccess and operate various system components.

User Interface

The function of computer interfaces in some respects is similar toautomobile operation interfaces. Automobile operation interface elementssuch as steering wheels, gearshifts, and speedometers facilitate theaccess, operation, and display of automobile resources, functionality,and status. Computer interaction interface elements such as check boxes,cursors, menus, scrollers, and windows (collectively and commonlyreferred to as widgets) similarly facilitate the access, operation, anddisplay of data and computer hardware and operating system resources,functionality, and status. Operation interfaces are commonly called userinterfaces. Graphical user interfaces (GUIs) such as the Apple MacintoshOperating System's Aqua, Microsoft's Windows XP, or Unix's X-Windowsprovide a baseline and means of accessing and displaying information,graphically, to users.

Networks

Networks are commonly thought to comprise of the interconnection andinteroperation of clients, servers, and intermediary nodes in a graphtopology. It should be noted that the term “server” as used hereinrefers generally to a computer, other device, software, or combinationthereof that processes and responds to the requests of remote usersacross a communications network. Servers serve their information torequesting “clients.” The term “client” as used herein refers generallyto a computer, other device, software, or combination thereof that iscapable of processing and making requests and obtaining and processingany responses from servers across a communications network. A computer,other device, software, or combination thereof that facilitates,processes information and requests, and/or furthers the passage ofinformation from a source user to a destination user is commonlyreferred to as a “node.” Networks are generally thought to facilitatethe transfer of information from source points to destinations. A nodespecifically tasked with furthering the passage of information from asource to a destination is commonly called a “router.” There are manyforms of networks such as Local Area Networks (LANs), Pico networks,Wide Area Networks (WANs), Wireless Networks (WLANs), etc. For example,the Internet is generally accepted as being an interconnection of amultitude of networks whereby remote clients and servers may access andinteroperate with one another.

SUMMARY

Although all of the aforementioned portable computing systems exist, noeffective solution to securely access, execute, and process data isavailable in an extremely compact form. Currently, PDAs, which areconsidered among the smallest portable computing solution, are bulky,provide uncomfortably small user interfaces, and require too much powerto maintain their data. Current PDA designs are complicated and cost alot because they require great processing resources to provide customuser interfaces and operating systems. Further, current PDAs aregenerally limited in the amount of data they can store or access. Nosolution exists that allows users to employ traditional large userinterfaces they are already comfortable with, provides greaterportability, provides greater memory footprints, draws less power, andprovides security for data on the device. As such, the disclosedtunneling client access point (TCAP) is very easy to use; at most itrequires the user to simply plug the device into any existing andavailable desktop or laptop computer, through which, the TCAP can makeuse of a traditional user interface and input/output (I/O) peripherals,while the TCAP itself, otherwise, provides storage, execution, and/orprocessing resources. Thus, the TCAP requires no power source tomaintain its data and allows for a highly portable “thumb” footprint.Also, by providing the equivalent of a plug-n-play virtual privatenetwork (VPN), the TCAP provides certain kinds of accessing of remotedata in an easy and secure manner that was unavailable in the prior art.

In accordance with certain aspects of the disclosure, theabove-identified problems of limited computing devices are overcome anda technical advance is achieved in the art of portable computing anddata access. An exemplary tunneling client access point (TCAP) includesa method to dispose a portable storage device in communication with aterminal. The method includes providing the memory for access on theterminal, executing processing instructions from the memory on theterminal to access the terminal, communicating through a conduit, andprocessing the processing instructions.

In accordance with another embodiment, a portable tunneling storageprocessor is disclosed. The apparatus has a memory and a processordisposed in communication with the memory, and configured to issue aplurality of processing instructions stored in the memory. Also, theapparatus has a conduit for external communications disposed incommunication with the processor, configured to issue a plurality ofcommunication instructions as provided by the processor, configured toissue the communication instructions as signals to engage incommunications with other devices having compatible conduits, andconfigured to receive signals issued from the compatible conduits.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings illustrate various non-limiting, example,inventive aspects in accordance with the present disclosure:

FIG. 1 is of a flow diagram illustrating embodiments of a tunnelingclient access point (TCAP);

FIG. 2 is of a flow diagram illustrating embodiments of a system oftunneling client access point and access terminal interaction;

FIG. 3 is of a flow diagram illustrating embodiments of engaging thetunneling client access point to an access terminal interaction;

FIG. 4 is of a flow diagram illustrating embodiments of accessing thetunneling client access point and server through an access terminal;

FIGS. 5-8 is of a flow diagram illustrating embodiments of facilities,programs, and/or services that the tunneling client access point andserver may provide to the user as accessed through an access terminal;

FIG. 9 is of a block diagram illustrating embodiments of a tunnelingclient access point server controller;

FIG. 10 is of a block diagram illustrating embodiments of a tunnelingclient access point controller;

The leading number of each reference number within the drawingsindicates the first figure in which that reference number is introduced.As such, reference number 101 is first introduced in FIG. 1. Referencenumber 201 is first introduced in FIG. 2, etc.

DETAILED DESCRIPTION Topology

FIG. 1 illustrates embodiments for a topology between a tunneling clientaccess point (TCAP) (see FIG. 10 for more details on the TCAP) and TCAPserver (TCAPS) (see FIG. 9 for more details on the TCAPS). In thisembodiment, a user 133 a may plug-in a TCAP into any number of accessterminals 127 located anywhere. Access terminals (ATs) may be any numberof computing devices such as servers, workstations, desktop computers,laptops, portable digital assistants (PDAs), and/or the like. The typeof AT used is not important other than the device should provide acompatible mechanism of engagement to the TCAP 130 and provide anoperating environment for the user to engage the TCAP through the AT. Inone embodiment, the TCAP provides a universal serial bus (USB) connectorthrough which it may plug into an AT. In other embodiment, the TCAP mayemploy Bluetooth, WiFi and/or other wireless connectivity protocols toconnect with ATs that are also so equipped. In one embodiment, the ATprovides Java and/or Windows runtime environments, which allows the TCAPto interact with the input/output mechanisms of the AT. See FIG. 9 formore details and embodiments on the types of connections that may beemployed by the TCAP. Once the TCAP has engaged with an AT, it canprovide the user with access to its storage and processing facilities.

If the AT is connected to a communication network 113, the TCAP may thencommunicate beyond the AT. In one embodiment, the TCAP can provideextended storage and/or processing resources by engaging servers 110,115, 120, which have access to and can provide extended storage 105 tothe TCAP through the AT. In one embodiment, a single server and storagedevice may provide such TCAP server support. In another embodiment,server support is provided over a communications network, e.g., theInternet, by an array of front-end load-balancing servers 120. Theseservers can provide access to storage facilities within the servers orto remote storage 105 across a communications network 113 b, c (e.g., alocal area network (LAN)). In such an embodiment, a backend server 110may offload the front-end server with regard to data access to providegreater throughput. For purposes of load balancing and/or redundancy, abackup server 115 may be similarly situated to provide for access andbackup in an efficient manner. In such an embodiment, the back-endservers may be connected to the front-end servers through acommunications network 113 b (e.g., wide area network (WAN)). Thebackend servers 110, 115 may be connected to the remote storage 105through a communications network 113 c as well (e.g., a high speed LAN,fiber-channel, and/or the like).

Thus, to the user 133 a, the contents of the TCAP 130 appear on the ATas being contained on the TCAP 125 even though much of the contents mayactually reside on the servers 115, 120 and/or the servers' storagefacilities 105. In these ways, the TCAP “tunnels” data through an AT.The data may be provided through the AT's I/O for the user to observewithout it actually residing on the AT. Also, the TCAP may tunnel datathrough an AT across a communications network to access remote serverswithout requiring its own more complicated set of peripherals and I/O.

TCAP and AT Interaction

FIG. 2 illustrates embodiments for a system of tunneling client accesspoint (TCAP) (see FIG. 10 for more details on the TCAP) and accessterminal interaction. FIG. 2 provides an overview for TCAP and ATinteraction and subsequent figures will provide greater detail onelements of the interaction. In this embodiment, a user engages the TCAP201. For example, the user may plug the TCAP into an AT via the AT's USBport. Thereafter the user is presented with a login prompt 205 on theAT's display mechanism, e.g., on a video monitor. After a usersuccessfully logs in (for example by providing a user name and password)204, the TCAP can then accept user inputs from the AT and itsperipherals (the TCAP can then also provide output to the user via theAT's peripherals).

The user may employ the AT's input peripherals as user input devicesthat control actions on the TCAP. Depending on the user's actions 215,the TCAP can be used by the AT as a storage device from which it canaccess and store data and programs 225. For example, if the user takesthe action of opening a file from the TCAP's memory, e.g., by doubleclicking on an icon when the TCAP is mounted as a USB drive on the AT,then the AT may treat the TCAP as a memory device and retrieveinformation from the TCAP 225. If the user's action 215 is one that isdirected at executing on the TCAP 215, then the AT will not be involvedin any execution. For example, if the user drops an icon representing agraphics file onto a drag-and-drop location visually representing theTCAP, then the file may be copied to the TCAP where it will process andspool the file for sending the graphics file to be printed at a remotelocation. In such a case, all of the requirements to process and spoolthe file are handled by the TCAP's processor and the AT would only beused as a mechanism for user input and output and as a conduit throughwhich the TCAP may send files.

Regardless of if there is an action 215 to execute on the TCAP 220 or toaccess or store data on the TCAP 225, the AT is used to display thestatus of any actions 230. At any time the user may select to terminateTCAP related facilities executing either on the AT, a backend server, onthe TCAP itself, and/or the like 235. In one embodiment, the user mayselect a quit option that is displayed on the AT's screen. In anotherembodiment, the user may simply disengage the TCAP from the AT bysevering the connection (e.g., turning power off, physically pulling thedevice off the AT, turning off wireless transmissions, and/or the like).It should be noted that such abrupt severing may result in the loss ofdata, file corruption, etc. if the TCAP has not saved data that is onthe AT or on some remote server, however, if the TCAP is employing flashlike memory, its contents should remain intact.

If there is no instruction signal to terminate the TCAP 235, executionwill continue and the TCAP will continue to take and look for input fromthe user. Of course if the TCAP has been set to perform certain actions,those actions will continue to execute, and the TCAP may respond toremote servers when it is communicating with them through the AT. Whenthe user issues a terminate signal 235, then the TCAP will shut down bysaving any data to the TCAP that is in the AT's memory and thenterminating any programs executing on both the AT and TCAP that wereexecuted by and/or from the TCAP 240. If no activities are taking placeon the TCAP and all the data is written back to the TCAP 240, then theTCAP may optionally unmount itself from the AT's file-system 245. Atthis point, if there is a TCAP I/O driver executing on the AT, thatdriver may be terminated as triggered by the absence of the TCAP at amount point 250. After the TCAP is unmounted and/or the TCAP I/O driveris terminated, it is safe to disengage the TCAP from the AT.

TCAP and AT Interaction

FIG. 3 illustrates embodiments engaging the tunneling client accesspoint to an access terminal interaction. Examples of engaging the TCAP301 with an AT were discussed above in FIG. 1 127, 130, 133 a and FIG. 2201. In one embodiment, the TCAP 130 is engaged with an access terminal327, 305. As mentioned in FIG. 1, the TCAP is capable of engaging withATs using a number of mechanisms. In one embodiment, the TCAP has a USBconnector for plugging into an AT, which acts as a conduit for power anddata transfer. In another embodiment, the TCAP may use Bluetooth toestablish a wireless connection with a number of ATs. In anotherembodiment, the TCAP may employ WiFi. In yet another embodiment, theTCAP may employ multiple communications mechanisms. It should be noted,with some wireless mechanisms like Bluetooth and WiFi, simply cominginto proximity with an AT that is configured for such wirelesscommunication may result in the TCAP engaging with and establish acommunications link with the AT. In one embodiment, the TCAP has a“connect” button that will allow such otherwise automatically engaginginteractions take place only if the “connect” button is engaged by auser. Such an implementation may provide greater security for users (seeFIG. 10 for more details on the TCAP).

After being engaged 305, the TCAP will then power on. In an embodimentrequiring a direct connection, e.g., USB, simply plugging the TCAP intothe AT provides power. In a wireless embodiment, the TCAP may be on in alower powered state or otherwise turned on by engaging the connectbutton as discussed above. In such an embodiment, the TCAP can employvarious on-board power sources (see FIG. 10 for more details on theTCAP). The TCAP then may load its own operating system 315. Theoperating system can provide for interaction with the AT. In oneembodiment, a Java runtime is executed on the TCAP, and Java appletscommunicate with the AT through Java APIs. In another embodiment, adriver is loaded onto the AT, and the on-TCAP Java operating systemapplets communicate to and through the AT via the driver running on theAT, wherein the driver provides an API through and to which messages maybe sent.

After engaging with the AT, the TCAP can provide its memory space to theAT 320. In one embodiment, the TCAP's memory is mapped and mounted as avirtual disk drive 125 storage 325. In this manner, the TCAP may beaccessed and manipulated as a standard storage device through the AT'soperating system. Further, the TCAP and in some cases the AT candetermine if the AT is capable of accessing program instructions storedin the TCAP's memory 330. In one embodiment, the AT's operating systemlooks to auto-run a specified file from any drive as it mounts. In suchan embodiment, the TCAP's primary interface may be specified in such aboot sequence. For example, under windows, an autorun.inf file canspecify the opening of a program from the TCAP by the AT; e.g.,OPEN=TCAP.EXE.

Many operating systems are capable of at least accessing the TCAP as aUSB memory drive 330 and mounting its contents as a drive, which usuallybecomes accessible in file browsing window 125. If the TCAP does notmount, the AT's operating system will usually generate an errorinforming the user of a mounting problem. If the AT is not capable ofexecuting instruction from the TCAP, a determination is made if anappropriate driver is loaded on the AT to access the TCAP 335. In oneembodiment, the TCAP can check to see if an API is running on the AT.For example, the TCAP provide an executable to be launched, e.g., asspecified through autorun.inf, and can establish communications throughits connection to the AT, e.g., employing TCP/IP communications over theUSB port. In such an embodiment, the TCAP can ping the AT for theprogram, and if an acknowledgement is received, the TCAP has determinedthat proper drivers and APIs exist. If no such API exists, the TCAP maylaunch a driver installation program for the AT as through anautorun.inf. In an alternative embodiment, if nothing happens, a usermay double click onto an installer program that is stored on the mountedTCAP 342, 340. It should be noted, that although the TCAP's memory spacemay be mounted, certain areas of the TCAP may be inaccessible untilthere is an authorization. For example, certain areas and content on theTCAP may be encrypted. It should be noted that any such access terminalmodules that drive AT and TCAP interaction may be saved onto the TCAP bycopying the module to a mounted TCAP. Nevertheless, if the AT is capableof accessing program instructions in TCAP memory 330, a TCAP driver isloaded on the AT 335, and/or the user engages a program in the TCAPmemory 340, then the AT can execute program instructions from the TCAP'smemory, which allows the TCAP to use the AT's I/O and allowing the userto interface with TCAP facilities 345. It should be noted that some ATsmay not be able to mount the TCAP at all. In such an instance, the usermay have to install the TCAP drivers by downloading them from a serveron the Internet, loading them from a diskette or CD, and/or the like.Once the TCAP is engaged to the AT 301, execution may continue 398.

TCAP and AT Interaction

FIG. 4 illustrates embodiments accessing the tunneling client accesspoint and server through an access terminal. Upon engaging the TCAP tothe AT as described in FIG. 3 301, 398, the user may then go on toaccess the TCAP and its services 498. It should be noted that users mayaccess certain unprotected areas of the TCAP once it has been mounted,as described in FIG. 3. However, to more fully access the TCAP'sfacilities, the user may be prompted to either login and/or registrationwindow 205 a to access the TCAP and its services, which may be displayedon the AT 405. It is important to note that in one embodiment, theexecution of the login and/or registration routines are handled by theTCAP's processor. In such an embodiment, the TCAP may run a small Webserver providing login facilities, and connect to other Web basedservices through the AT's connection to the Internet. Further, the TCAPmay employ a basic Web browsing core engine by which it may connect toWeb services through the AT's connection to a communications networklike the Internet. For purposes of security, in one embodiment, the TCAPmay connect to a remote server by employing a secure connection, e.g.,HTTPS, VPN, and/or the like.

Upon displaying a login window 405, e.g., 205 a, the user may select toregister to access the TCAP and its services, or they may simply log inby providing security verification. In one example, securityauthorization may be granted by simply providing a user and password asprovided through a registration process. In another embodiment,authorization may be granted through biometric data. For example, theTCAP may integrate a fingerprint and/or heat sensor IC into its housing.Employing such a device, and simply by providing one's finger print bylaying your finger to the TCAP's surface, would provide the loginfacility with authorization if the user's finger print matches one thatwas stored during the registration process.

If the user does not attempt to login 415, i.e., if the user wishes toregister to use the TCAP and its services, then the TCAP can determineif the AT is online 420. This may be accomplished in a number of ways.In one embodiment, the TCAP itself may simply ping a given server and ifacknowledgement of receipt is received, the TCAP is online. In anotherembodiment, the TCAP can query for online status by engaging the ATthrough the installed APIs. If the AT is not online, then the user maybe presented with an error message 425. Thus, if a user does not have alogin, and does not have the ability to register, then restricted areasof the TCAP will remain unavailable. Thereafter, flow can continue 498and the user may have another opportunity to login and/or register. Inone embodiment as a login integrity check, the TCAP keeps track of thenumber of failed attempts to login and/or register and may lock-out allfurther access if a specified number of failed attempts occurs. In oneembodiment, the lockdown may be permanent by erasing all data on theTCAP. In another embodiment, the TCAP will disallow further attempts fora specified period of time.

If the user is attempting to register 415, and the AT is online 420,then the user map provide registration information 440 into a screenform 440 a. Registration information fields may require a user's name,address, email address, credit card information, biometric information(e.g., requiring the user to touch a biometric fingerprint IC on theTCAP), and/or the like. The TCAP may determine if all the informationwas provided as required for registration and may query backend serversto determine if the user information is unique 445. If the user did notproperly fill out the registration information or if another user isalready registered, the TCAP can provided an error message to sucheffect. Also, both the TCAP and its back-end servers may make logentries tracking such failed attempts for purposes of defending againstfraud and/or security breaches. The user may then modify theregistration information 440 and again attempt to register. Similarly tothe login integrity checks, the TCAP can lockout registration attemptsif the user fails to register more than some specified number of times.

Upon providing proper registration information 445 or proper loginauthentication 415, the TCAP can query backend servers to see if theuser is registered. In one embodiment, such verification may be achievedby sending a query to the servers to check its database for theauthorization information and/or for duplicate registrations. Theservers would then respond providing an acknowledgment of properregistration and authorization to access data on the backend servers. Ifthe users are not registered on the backend servers 430, then the TCAPcan provide an error message to the user for display on the AT to sucheffect 435. In an alternative embodiment, the registration informationmay be stored on the TCAP itself. In one embodiment, the registrationwould be maintained in encrypted form. Thus, the user's logininformation may be checked relative to the information the TCAP itself,and if there is a match, access may be granted, otherwise an errormessage will be displayed 435. The TCAP may then continue 498 to operateas if it were just engaged to the AT.

If the user is confirmed to be registered 430, then the TCAP may provideoptions for display 453, 453 a. Depending on the context and purpose ofa particular TCAP, the options may vary. For example, the a screen 453 amay provide the user with the options to access data either online oroffline. The user might simply click on a button and gain secure accessto such data that may be decrypted by the TCAP. In one embodiment, theTCAP will determine if the AT is online 455. If this was alreadydetermined 420, this check 455 may be skipped.

If the AT is online 455, optionally, the TCAP determines if the userwishes to synchronize the contents of the TCAP with storage facilitiesat the backend server 470. In one embodiment, the user may designatethat such synchronization is to always take place. If synchronization isspecified 470, then the TCAP will provide and receive updated data toand from the backend servers, overwriting older data with updatedversions of the data 475. If the AT is online 455 and/or after anysynchronization 475, the TCAP may provide the user with all of itsservice options as authorized by the account and programs available onthe TCAP and at the backend server 480. Once again, these facilities,programs, and/or services may vary greatly depending on the context anddeployment requirements of the user. The options to be presented to theuser from the TCAP or the TCAP services from the backend server, asdisplayed through the TCAP onto the AT's display 480, are myriad andsome example embodiments are provided in FIGS. 5-8. Upon presenting theuser with the options, the user is then able to access, execute, storedata and programs on the TCAP and on the remote server 485. All areas ofthe TCAP and services are then open, including any encrypted data areas.

If the AT is not online 455, the TCAP may provide options for the usernot including online services 460. In one embodiment, the online optionsthat may be presented on the AT display will be dimmed and/or omitted toreflect the lack of accessibility. However, the user will be able toaccess, execute, store data and programs on the TCAP, including anyencrypted data areas 465.

TCAP Facilities and Services

FIGS. 5-8 illustrate embodiments of facilities, programs, and/orservices that the tunneling client access point and server may provideto the user as accessed through an AT. Any particular set of facilitiesmay have a myriad of options. The options and the general nature of thefacilities provided on any particular TCAP are dependant upon therequirements of a given set of users. For example, certain groups and/oragencies may require TCAPS to be targeted towards consumer photographs,and may employ TCAPs to further that end. Other groups may require highsecurity facilities, and tailor the TCAPs accordingly. In variousenvironments, an organization may wish to provide a secureinfrastructure to all of its agents for securely accessing theorganization's data from anywhere and such an organization could tailorthe TCAPs contents to reflect and respond to its needs. By providing ageneralized infrastructure on the TCAP backend servers and within theTCAP by using a generalized processor, the TCAPs may be deployed innumerous environments.

In one particular embodiment as in FIG. 5, the TCAP provides facilitiesto access, process, and store email, files, music, photos and videosthrough the TCAP. Upon engaging 101 of FIG. 1 the TCAP 130 to an AT 307,the TCAP will mount and display through the AT's file browser window 125of FIG. 1. As has already described, in the case where the AT has noTCAP driver software, the user may double click on the installersoftware stored on the TCAP 507. Doing so will launch the installersoftware from the TCAP's memory to execute on the AT, and the user maybe presented with a window to confirm the desire to install the TCAPsoftware onto the AT 507. Upon confirming the install 507, the softwarewill install on the AT and the user will be asked to wait as they areapprised of the install progress 509.

Upon installation, the TCAP front-end software may execute and presentthe user with various options in various and fanciful interface formats511, 460, 480 of FIG. 4. In one embodiment, these user interfaces andprograms are Java applications that may execute on the AT and a presentJava runtime. In an alternative embodiment, a small applet may run onthe AT, but all other activities may execute on the TCAP's processor,which would use the AT display only as a display terminal. In theembodiment where the TCAP executes program instructions, the TCAP may beengaged to receive commands and execute by receiving a signal from theaccess terminal driver instructing it to execute certain program filesor, alternatively, looking to default location and executing programinstructions. In yet another embodiment, the TCAP may obtain updatedinterfaces and programs from a backend server for execution either onthe TCAP itself and/or the AT; this may be done by synchronization withthe backend server and checking for updates of specified files at thebackend server. By engaging the user interface, perhaps by clicking on abutton to open the TCAP facilities and services 511, the interface mayfurther unfurl to present options to access said facilities and services513. Here, the interface may reflect ownership of the TCAP by providinga welcome screen and showing some resources available to the user; forexample, a button entitled “My Stuff” may serve as a mechanism toadvance the user to a screen where they may access their personal datastore. At this point the user may attempt to login to access their databy engaging an appropriate button, which will take them to a screen thatwill accept login information 519. Alternatively, the user may alsoregister if it is their first time using the TCAP by selecting anappropriate button, which will advance the user to a registration screen515 wherein the user may enter their name, address, credit cardinformation, etc. Upon successfully providing registration information,the user may be prompted for response to further solicitations on afollow-up screen 517. For example, depending on the services offered fora particular TCAP, the user may be provided certain perks like 5 MB offree online storage on a backend server, free photographic prints, freeemail access, and/or the like 517.

After the user is prompted to login 518 and successfully provides properlogin information 519, or after successfully registering 515 and havingresponded to any solicitations 517, the user may be provided withgeneral options 521 to access data stored on the TCAP itself 522 or intheir online account 520 maintained on a backend server. For example, ifthe user selects the option to access their online storage 520, they maybe presented with more options to interact with email, files, music,photos and videos that are available online 523. Perhaps if the userwished to check their email, the user might select to interact withtheir email, and a screen allowing them to navigate through their emailaccount(s) would be presented 525. Such online access to data may befacilitated through http protocols whereby the TCAP applications sendand receive data through http commands across a communications networkinteracting with the backend servers and/or other servers. Any receivedresults may be parsed and imbedded in a GUI representation of a Javaapplication. For example, the email facility may run as a Java applet525 and may employ a POP mail protocol to pull data from a specifiedmail server to present to the user.

Similarly, many other facilities may be engaged by the user through theTCAP. In one embodiment, the user may drag 508 a file 506 onto adrag-and-drop zone 505 that is presented on the TCAP interface. Upon sodoing, various drag-and-drop options may unfurl and present themselvesto the user 550. It should be noted that the file may come fromanywhere, i.e., from the AT, the TCAP, and/or otherwise. For example,upon dragging and dropping a graphics file, a user may be prompted withoptions to order prints, upload the file to an online storage space,save the file to the TCAP's memory space, cancel the action, and/or thelike 550. If the user sends the file for storage, or otherwise wishes tosee and manage their data, an interface allowing for such management maybe presented 555. The interface may organize and allow access to generaldata, picture, and music formats 554, provide usage statistics (e.g.,free space, capacity, used space, etc.) 553, provide actions tomanipulate and organize the data 552, provide status on storage usage onthe TCAP 551 and online 549, and/or the like.

Should the user engage a user interface element indicating the wish tomanipulate their picture data 548, the TCAP interface will update toallow more specific interaction with the user's photos 557. In such ascreen, the user may select various stored pictures and then indicate adesire to order photo prints by engaging the appropriate user interfaceelement 558. Should the user indicate their desire for prints 558, theywill be presented with an updated interface allowing the specificationof what graphics files they wish to have printed 559. In one embodiment,the users may drag-and-drop files into a drop zone, or otherwise engagefile browsing mechanisms 560 that allow for the selection of desiredfiles. Upon having identified the files for prints 559, a user may bepresented with an interface allowing for the selection of print sizesand quantities 561. After making such specifications, the user may berequired to provide shipping information 563 and information forpayments 565. After providing the billing information to a backendserver for processing and approval, the user may be presented with aconfirmation interface allowing for editing of the order, providingconfirmation of costs, and allowing for submission of a final order forthe selected prints 567. Upon submitting the order, the TCAP willprocess the files for spooling to a backend server that will accept theorder and files, which will be developed as prints and the user'saccount will be charged accordingly. In one embodiment, all of the aboveorder and image processing operations occur and execute on the TCAP CPU.For example, the TCAP may employ various rendering technologies, e.g.,ghostscript, to allow it to read and save PDFs and other media formats.

FIG. 6 goes on to illustrate embodiments and facets of the facilities ofFIG. 5. The TCAP interface allows the user to perform various actions atany given moment. As has already been discussed in FIG. 5, the user maydrag 508 a file 506 onto a drag and drop zone 505 so as to provide thefile to the TCAP for further manipulation. As in 550 of FIG. 5, the usermay be presented with various options subsequent to a drag-and-dropoperation. Also, the TCAP interface may provide visual feedback thatfiles have been dropped in the drop zone by highlighting the drop zone505 b. Should the user wish, they may close the TCAP interface byengaging a close option 633. Also, the ability to change and/or updatetheir personal information may be accessed through the TCAP interface616, which would provide a form allowing the user to update theirregistration information 630. In one embodiment, should the user forgettheir login information, they may request login help 635 and the TCAPwill send their authorization information to the last known emailaddress and inform the user of same 640. Also, the TCAP interface mayprovide help facilities that may be accessed at any time by simplyengaging a help facility user interface element 617. So doing willprovide the user with help screen information as to how to interact withthe TCAP's facilities 625.

Upon providing proper login information 619 and logging-in 619, the usermay be presented with a welcome screen with various options to accesstheir data 621 as has already been discussed in FIG. 5, 521. By engaginga user interface element to access online storage 620, the user may bepresented with various options to interact with online storage 623, 523of FIG. 5. Should the user wish to interact with data on the TCAPitself, the user may indicate so by engaging the appropriate userinterface option 622. So doing will provide the user with furtheroptions related to data stored on the TCAP 655. The user may engage anoption to view the storage contents 658 and the TCAP interface willprovide a listing of the contents 662, which may be manipulated throughselection and drag-and-drop operations with the files.

In one embodiment, the user may order prints of photos 657 from filesthat are on the TCAP itself. As discussed in FIG. 5, the user may selectfiles for which they desire prints 660. Here, the selected files willfirst be processed by the TCAP in preparation for sending to backendservers and file manipulations 670. The user may specify variousattributes regarding the prints they desire, e.g., the size, number,cropping, red-eye correction, visual effects, and/or the like 661. Inone embodiment, such processing occurs on the TCAP processor, while inother embodiments such processing can take place on the AT or backendserver. Once again, the user may provide a shipping address 663, andmake a final review to place the order 667. Upon committing to the order667, the processed files are uploaded to the backend servers that willuse the files to generate prints 690. A confirmation screen may then beprovided to the user with an order number and other relevant information695.

FIG. 7 goes on to illustrate embodiments and facets of the facilities ofFIGS. 5-6 as may apply in different environments. As is demonstrated,the look and feel of the TCAP interface is highly malleable and canserve in many environments. FIG. 7 illustrates that even within a singleorganization, various environments might benefit from TCAPs and servicestailored to serve such environments 733 b-d. In this case TCAPs canserve in consumer 733 b, industry trade 733 c, corporate 733 d, and/orthe like environments.

As has already been discussed, initially in any of the environments,after engaging the TCAP to an AT, the user may be prompted to installthe TCAP interface 705 and informed of the installation procedure 710.The user may then be presented with the installed TCAP interface 715,which may be activated by engaging an interface element to unfurl theinterface, e.g., in this case by opening the top to a can of soda 717.Opening the interface will present the user with various options as 720,as has already been discussed in FIGS. 5-6. Similarly the user may login725 or make a selection to register for various TCAP services andprovide the requisite information in the provided form 730. Uponregistering and/or logging-in 725, various options may be presentedbased upon the configuration of the TCAP. For example, if the TCAP wasconfigured and tailored for consumers, then upon logging in 725 theconsumer user might be presented 733 a-b with various consumer relatedoptions 740. Similarly, if the TCAP were tailored for 733 a, c the tradeindustry or 733 a, d the corporate environment, options specific to thetrade industry 770 and corporate environment 760 may be presented.

In one embodiment, an organization wishing to provide TCAPs to consumersmight provide options 740 for free music downloads 743, free Internetradio streaming 748, free news (e.g., provided through an RSS feed froma server) 766, free photo printing 750, free email 740, free coupons742, free online storage 741, and/or the like. Users could furtherengage such services (e.g., clicking free music file links fordownloading to the TCAP, by ordering prints 750, etc. For example, theuser may select files on the TCAP 750, select the types of photos theywould like to receive 752, specify a delivery address 754, confirm theorder 756 all of which will result in the TCAP processing the files anduploading them to the backend servers for generation of prints (as hasalready been discussed in FIGS. 5-6).

In another embodiment, an organization wishing to provide TCAPs to atrade industry might provide options 770 for advertising 780, events775, promotions 772, and/or the like. It is important to note thatinformation regarding such options may be stored either on the TCAP orat a backend server. In one embodiment, such information may beconstantly synchronized from the backend servers to the TCAPs. Thiswould allow an organization to provide updates to the trade industry toall authorized TCAP “key holders.” In such an embodiment, the user maybe presented with various advertising related materials for theorganization, e.g., print, television, outdoor, radio, web, and/or thelike 780. With regard to events, the user may be presented with variousrelated materials for the organization, e.g., trade shows, musicregional, sponsorship, Web, and/or the like 775. With regard topromotions, the user may be presented with various related materials forthe organization, e.g., rebates, coupons, premiums, and/or the like 772.

In another embodiment, an organization wishing to provide TCAPs to thosein the corporate environment and might provide options relating tovarious corporate entities 760. Selecting any of the corporate entities760 may provide the user with options to view various reports,presentations, and/or the like, e.g., annual reports, 10K reports,and/or the like 765. Similarly, the reports may reside on the TCAPand/or the corporate TCAP can act as a security key allowing the user tosee the latest corporate related materials from a remote backend server.

FIG. 8 goes on to illustrate embodiments and facets of the facilities ofFIGS. 5-7 as may apply in different environments. FIG. 8 illustratesthat TCAPs may serve to provide heightened security to any environment.As has been discussed in previous figures, users may engage the TCAPinterface 805 to access various options 810. The TCAP interface ishighly adaptable and various services may be presented within it. Forexample, a stock ticker may be provided as part of the interface in afinancial setting 810. Any number of live data feeds may dynamicallyupdate on the face of the interface. Upon logging-in 815 or registeringa new account 820, the user may be informed that communications that aretaking place are secured 825. In one embodiment, various encryptionformats may be used by the TCAP to send information securely to thebackend servers. It is important to note that in such an embodiment,even if data moving out of the TCAP and across the AT were captured atthe AT, such data would not be readable because the data was encryptedby the TCAP's processor. As such, the TCAP acts as a “key” and providesa plug-and-play VPN to users. Such functionality, heretofore, has beenvery difficult to set up and/or maintain. In this way, allcommunications, options presented and views of user data are madeavailable only to the TCAP with the proper decryption key. In heightenedsecurity environments, display of TCAP data is provided on the screenonly in bitmapped format straight to the video memory of the AT and,therefore, is not stored anywhere else on the AT. This decreases thelikelihood of capturing sensitive data. As such, the user may accesstheir data on the TCAP and/or online 830 in a secure form whereby theuser may navigate and interact with his/her data and various services835 in a secure manner.

Tunneling Client Access Point Server Controller

FIG. 9 illustrates one embodiment incorporated into a tunneling clientaccess point server (TCAPS) controller 901. In this embodiment, the TCAPcontroller 901 may serve to process, store, search, serve, identify,instruct, generate, match, and/or update data in conjunction with a TCAP(see FIG. 10 for more details on the TCAP). TCAPS act as backend serversto TCAPs, wherein TCAPS provide storage and/or processing resources togreat and/or complex for the TCAP to service itself. In effect, theTCAPS transparently extend the capacity of a TCAP.

In one embodiment, the TCAPS controller 901 may be connected to and/orcommunicate with entities such as, but not limited to: one or more usersfrom user input devices 911; peripheral devices 912; and/or acommunications network 913. The TCAPS controller may even be connectedto and/or communicate with a cryptographic processor device 928.

A TCAPS controller 901 may be based on common computer systems that maycomprise, but are not limited to, components such as: a computersystemization 902 connected to memory 929.

Computer Systemization

A computer systemization 902 may comprise a clock 930, centralprocessing unit (CPU) 903, a read only memory (ROM) 906, a random accessmemory (RAM) 905, and/or an interface bus 907, and most frequently,although not necessarily, are all interconnected and/or communicatingthrough a system bus 904. Optionally, a cryptographic processor 926 maybe connected to the system bus. The system clock typically has a crystaloscillator and provides a base signal. The clock is typically coupled tothe system bus and various clock multipliers that will increase ordecrease the base operating frequency for other componentsinterconnected in the computer systemization. The clock and variouscomponents in a computer systemization drive signals embodyinginformation throughout the system. Such transmission and reception ofsignals embodying information throughout a computer systemization may becommonly referred to as communications. These communicative signals mayfurther be transmitted, received, and the cause of return and/or replysignal communications beyond the instant computer systemization to:communications networks, input devices, other computer systemizations,peripheral devices, and/or the like. Of course, any of the abovecomponents may be connected directly to one another, connected to theCPU, and/or organized in numerous variations employed as exemplified byvarious computer systems.

The CPU comprises at least one high-speed data processor adequate toexecute program modules for executing user and/or system-generatedrequests. The CPU may be a microprocessor such as AMD's Athlon, Duronand/or Opteron; IBM and/or Motorola's PowerPC; Intel's Celeron, Itanium,Pentium and/or Xeon; and/or the like processor(s). The CPU interactswith memory through signal passing through conductive conduits toexecute stored program code according to conventional data processingtechniques. Such signal passing facilitates communication within theTCAPS controller and beyond through various interfaces. Shouldprocessing requirements dictate a greater amount speed, mainframe andsuper computer architectures may similarly be employed.

Interface Adapters

Interface bus(ses) 907 may accept, connect, and/or communicate to anumber of interface adapters, conventionally although not necessarily inthe form of adapter cards, such as but not limited to: input outputinterfaces (I/O) 908, storage interfaces 909, network interfaces 910,and/or the like. Optionally, cryptographic processor interfaces 927similarly may be connected to the interface bus. The interface busprovides for the communications of interface adapters with one anotheras well as with other components of the computer systemization.Interface adapters are adapted for a compatible interface bus. Interfaceadapters conventionally connect to the interface bus via a slotarchitecture. Conventional slot architectures may be employed, such as,but not limited to: Accelerated Graphics Port (AGP), Card Bus,(Extended) Industry Standard Architecture ((E)ISA), Micro ChannelArchitecture (MCA), NuBus, Peripheral Component Interconnect (Extended)(PCI(X)), Personal Computer Memory Card International Association(PCMCIA), and/or the like.

Storage interfaces 909 may accept, communicate, and/or connect to anumber of storage devices such as, but not limited to: storage devices914, removable disc devices, and/or the like. Storage interfaces mayemploy connection protocols such as, but not limited to: (Ultra)(Serial) Advanced Technology Attachment (Packet Interface) ((Ultra)(Serial) ATA(PI)), (Enhanced) Integrated Drive Electronics ((E)IDE),Institute of Electrical and Electronics Engineers (IEEE) 1394, fiberchannel, Small Computer Systems Interface (SCSI), Universal Serial Bus(USB), and/or the like.

Network interfaces 910 may accept, communicate, and/or connect to acommunications network 913. Network interfaces may employ connectionprotocols such as, but not limited to: direct connect, Ethernet (thick,thin, twisted pair 10/100/1000 Base T, and/or the like), Token Ring,wireless connection such as IEEE 802.11 a-x, and/or the like. Acommunications network may be any one and/or the combination of thefollowing: a direct interconnection; the Internet; a Local Area Network(LAN); a Metropolitan Area Network (MAN); an Operating Missions as Nodeson the Internet (OMNI); a secured custom connection; a Wide Area Network(WAN); a wireless network (e.g., employing protocols such as, but notlimited to a Wireless Application Protocol (WAP), I-mode, and/or thelike); and/or the like. A network interface may be regarded as aspecialized form of an input output interface. Further, multiple networkinterfaces 910 may be used to engage with various communications networktypes 913. For example, multiple network interfaces may be employed toallow for the communication over broadcast, multicast, and/or unicastnetworks.

Input Output interfaces (I/O) 908 may accept, communicate, and/orconnect to user input devices 911, peripheral devices 912, cryptographicprocessor devices 928, and/or the like. I/O may employ connectionprotocols such as, but not limited to: Apple Desktop Bus (ADB); AppleDesktop Connector (ADC); audio: analog, digital, monaural, RCA, stereo,and/or the like; IEEE 1394a-b; infrared; joystick; keyboard; midi;optical; PC AT; PS/2; parallel; radio; serial; USB; video interface:BNC, composite, digital, Digital Visual Interface (DVI), RCA, S-Video,VGA, and/or the like; wireless; and/or the like. A common output deviceis a video display, which typically comprises a Cathode Ray Tube (CRT)or Liquid Crystal Display (LCD) based monitor with an interface (e.g.,DVI circuitry and cable) that accepts signals from a video interface.The video interface composites information generated by a computersystemization and generates video signals based on the compositedinformation in a video memory frame. Typically, the video interfaceprovides the composited video information through a video connectioninterface that accepts a video display interface (e.g., a DVI connectoraccepting a DVI display cable).

User input devices 911 may be card readers, dongles, finger printreaders, gloves, graphics tablets, joysticks, keyboards, mouse (mice),trackballs, trackpads, retina readers, and/or the like.

Peripheral devices 912 may be connected and/or communicate to I/O and/orother facilities of the like such as network interfaces, storageinterfaces, and/or the like. Peripheral devices may be audio devices,cameras, dongles (e.g., for copy protection, ensuring securetransactions with a digital signature, and/or the like), externalprocessors (for added functionality), goggles, microphones, monitors,network interfaces, printers, scanners, storage devices, video devices,visors, and/or the like.

It should be noted that although user input devices and peripheraldevices may be employed, the TCAPS controller may be embodied as anembedded, dedicated, and/or headless device, wherein access would beprovided over a network interface connection.

Cryptographic units such as, but not limited to, microcontrollers,processors 926, interfaces 927, and/or devices 928 may be attached,and/or communicate with the TCAPS controller. A MC68HC16microcontroller, commonly manufactured by Motorola Inc., may be used forand/or within cryptographic units. Equivalent microcontrollers and/orprocessors may also be used. The MC68HC16 microcontroller utilizes a16-bit multiply-and-accumulate instruction in the 16 MHz configurationand requires less than one second to perform a 512-bit RSA private keyoperation. Cryptographic units support the authentication ofcommunications from interacting agents, as well as allowing foranonymous transactions. Cryptographic units may also be configured aspart of CPU. Other commercially available specialized cryptographicprocessors include VLSI Technology's 33 MHz 6868 or SemaphoreCommunications' 40 MHz Roadrunner 184.

Memory

Generally, any mechanization and/or embodiment allowing a processor toaffect the storage and/or retrieval of information is regarded as memory929. However, memory is a fungible technology and resource, thus, anynumber of memory embodiments may be employed in lieu of or in concertwith one another. It is to be understood that a TCAPS controller and/ora computer systemization may employ various forms of memory 929. Forexample, a computer systemization may be configured wherein thefunctionality of on-chip CPU memory (e.g., registers), RAM, ROM, and anyother storage devices are provided by a paper punch tape or paper punchcard mechanism; of course such an embodiment would result in anextremely slow rate of operation. In a typical configuration, memory 929will include ROM 906, RAM 905, and a storage device 914. A storagedevice 914 may be any conventional computer system storage. Storagedevices may include a drum; a (fixed and/or removable) magnetic diskdrive; a magneto-optical drive; an optical drive (i.e., CDROM/RAM/Recordable (R), ReWritable (RW), DVD R/RW, etc.); and/or otherdevices of the like. Thus, a computer systemization generally requiresand makes use of memory.

Module Collection

The memory 929 may contain a collection of program and/or databasemodules and/or data such as, but not limited to: operating systemmodule(s) 915 (operating system); information server module(s) 916(information server); user interface module(s) 917 (user interface); Webbrowser module(s) 918 (Web browser); database(s) 919; cryptographicserver module(s) 920 (cryptographic server); TCAPS module(s) 935; and/orthe like (i.e., collectively a module collection). These modules may bestored and accessed from the storage devices and/or from storage devicesaccessible through an interface bus. Although non-conventional softwaremodules such as those in the module collection, typically, are stored ina local storage device 914, they may also be loaded and/or stored inmemory such as: peripheral devices, RAM, remote storage facilitiesthrough a communications network, ROM, various forms of memory, and/orthe like.

Operating System

The operating system module 915 is executable program code facilitatingthe operation of a TCAPS controller. Typically, the operating systemfacilitates access of I/O, network interfaces, peripheral devices,storage devices, and/or the like. The operating system may be a highlyfault tolerant, scalable, and secure system such as Apple Macintosh OS X(Server), AT&T Plan 9, Be OS, Linux, Unix, and/or the like operatingsystems. However, more limited and/or less secure operating systems alsomay be employed such as Apple Macintosh OS, Microsoft DOS, Palm OS,Windows 2000/2003/3.1/95/98/CE/Millenium/NT/XP (Server), and/or thelike. An operating system may communicate to and/or with other modulesin a module collection, including itself, and/or the like. Mostfrequently, the operating system communicates with other programmodules, user interfaces, and/or the like. For example, the operatingsystem may contain, communicate, generate, obtain, and/or provideprogram module, system, user, and/or data communications, requests,and/or responses. The operating system, once executed by the CPU, mayenable the interaction with communications networks, data, I/O,peripheral devices, program modules, memory, user input devices, and/orthe like. The operating system may provide communications protocols thatallow the TCAPS controller to communicate with other entities through acommunications network 913. Various communication protocols may be usedby the TCAPS controller as a subcarrier transport mechanism forinteraction, such as, but not limited to: multicast, TCP/IP, UDP,unicast, and/or the like.

Information Server

An information server module 916 is stored program code that is executedby the CPU. The information server may be a conventional Internetinformation server such as, but not limited to Apache SoftwareFoundation's Apache, Microsoft's Internet Information Server, and/orthe. The information server may allow for the execution of programmodules through facilities such as Active Server Page (ASP), ActiveX,(ANSI) (Objective-) C (++), Common Gateway Interface (CGI) scripts,Java, JavaScript, Practical Extraction Report Language (PERL), Python,WebObjects, and/or the like. The information server may support securecommunications protocols such as, but not limited to, File TransferProtocol (FTP); HyperText Transfer Protocol (HTTP); Secure HypertextTransfer Protocol (HTTPS), Secure Socket Layer (SSL), and/or the like.The information server provides results in the form of Web pages to Webbrowsers, and allows for the manipulated generation of the Web pagesthrough interaction with other program modules. After a Domain NameSystem (DNS) resolution portion of an HTTP request is resolved to aparticular information server, the information server resolves requestsfor information at specified locations on a TCAPS controller based onthe remainder of the HTTP request. For example, a request such ashttp://123.124.125.126/myInformation.html might have the IP portion ofthe request “123.124.125.126” resolved by a DNS server to an informationserver at that IP address; that information server might in turn furtherparse the http request for the “/myInformation.html” portion of therequest and resolve it to a location in memory containing theinformation “myInformation.html.” Additionally, other informationserving protocols may be employed across various ports, e.g., FTPcommunications across port 21, and/or the like. An information servermay communicate to and/or with other modules in a module collection,including itself, and/or facilities of the like. Most frequently, theinformation server communicates with the TCAPS database 919, operatingsystems, other program modules, user interfaces, Web browsers, and/orthe like.

Access to TCAPS database may be achieved through a number of databasebridge mechanisms such as through scripting languages as enumeratedbelow (e.g., CGI) and through inter-application communication channelsas enumerated below (e.g., CORBA, WebObjects, etc.). Any data requeststhrough a Web browser are parsed through the bridge mechanism intoappropriate grammars as required by the TCAP. In one embodiment, theinformation server would provide a Web form accessible by a Web browser.Entries made into supplied fields in the Web form are tagged as havingbeen entered into the particular fields, and parsed as such. The enteredterms are then passed along with the field tags, which act to instructthe parser to generate queries directed to appropriate tables and/orfields. In one embodiment, the parser may generate queries in standardSQL by instantiating a search string with the proper join/selectcommands based on the tagged text entries, wherein the resulting commandis provided over the bridge mechanism to the TCAPS as a query. Upongenerating query results from the query, the results are passed over thebridge mechanism, and may be parsed for formatting and generation of anew results Web page by the bridge mechanism. Such a new results Webpage is then provided to the information server, which may supply it tothe requesting Web browser.

Also, an information server may contain, communicate, generate, obtain,and/or provide program module, system, user, and/or data communications,requests, and/or responses.

User Interface

A user interface module 917 is stored program code that is executed bythe CPU. The user interface may be a conventional graphic user interfaceas provided by, with, and/or atop operating systems and/or operatingenvironments such as Apple Macintosh OS, e.g., Aqua, Microsoft Windows(NT/XP), Unix X Windows (KDE, Gnome, and/or the like), and/or the like.The user interface may allow for the display, execution, interaction,manipulation, and/or operation of program modules and/or systemfacilities through textual and/or graphical facilities. The userinterface provides a facility through which users may affect, interact,and/or operate a computer system. A user interface may communicate toand/or with other modules in a module collection, including itself,and/or facilities of the like. Most frequently, the user interfacecommunicates with operating systems, other program modules, and/or thelike. The user interface may contain, communicate, generate, obtain,and/or provide program module, system, user, and/or data communications,requests, and/or responses.

Web Browser

A Web browser module 918 is stored program code that is executed by theCPU. The Web browser may be a conventional hypertext viewing applicationsuch as Microsoft Internet Explorer or Netscape Navigator. Secure Webbrowsing may be supplied with 128 bit (or greater) encryption by way ofHTTPS, SSL, and/or the like. Some Web browsers allow for the executionof program modules through facilities such as Java, JavaScript, ActiveX,and/or the like. Web browsers and like information access tools may beintegrated into PDAs, cellular telephones, and/or other mobile devices.A Web browser may communicate to and/or with other modules in a modulecollection, including itself, and/or facilities of the like. Mostfrequently, the Web browser communicates with information servers,operating systems, integrated program modules (e.g., plug-ins), and/orthe like; e.g., it may contain, communicate, generate, obtain, and/orprovide program module, system, user, and/or data communications,requests, and/or responses. Of course, in place of a Web browser andinformation server, a combined application may be developed to performsimilar functions of both. The combined application would similarlyaffect the obtaining and the provision of information to users, useragents, and/or the like from TCAPS enabled nodes. The combinedapplication may be nugatory on systems employing standard Web browsers.

TCAPS Database

A TCAPS database module 919 may be embodied in a database and its storeddata. The database is stored program code, which is executed by the CPU;the stored program code portion configuring the CPU to process thestored data. The database may be a conventional, fault tolerant,relational, scalable, secure database such as Oracle or Sybase.Relational databases are an extension of a flat file. Relationaldatabases consist of a series of related tables. The tables areinterconnected via a key field. Use of the key field allows thecombination of the tables by indexing against the key field; i.e., thekey fields act as dimensional pivot points for combining informationfrom various tables. Relationships generally identify links maintainedbetween tables by matching primary keys. Primary keys represent fieldsthat uniquely identify the rows of a table in a relational database.More precisely, they uniquely identify rows of a table on the “one” sideof a one-to-many relationship.

Alternatively, the TCAPS database may be implemented using variousstandard data-structures, such as an array, hash, (linked) list, struct,structured text file (e.g., XML), table, and/or the like. Suchdata-structures may be stored in memory and/or in (structured) files. Inanother alternative, an object-oriented database may be used, such asFrontier, ObjectStore, Poet, Zope, and/or the like. Object databases caninclude a number of object collections that are grouped and/or linkedtogether by common attributes; they may be related to other objectcollections by some common attributes. Object-oriented databases performsimilarly to relational databases with the exception that objects arenot just pieces of data but may have other types of functionalityencapsulated within a given object. If the TCAPS database is implementedas a data-structure, the use of the TCAPS database may be integratedinto another module such as the TCAPS module. Also, the database may beimplemented as a mix of data structures, objects, and relationalstructures. Databases may be consolidated and/or distributed incountless variations through standard data processing techniques.Portions of databases, e.g., tables, may be exported and/or imported andthus decentralized and/or integrated. In one embodiment, the databasemodule 919 includes three tables 919 a-c. A user accounts table 919 aincludes fields such as, but not limited to: a user name, user address,user authorization information (e.g., user name, password, biometricdata, etc.), user credit card, organization, organization account, TCAPunique identifier, account creation data, account expiration date;and/or the like. In one embodiment, user accounts may be activated onlyfor set amounts of time and will then expire once a specified date hasbeen reached. An user data table 919 b includes fields such as, but notlimited to: a TCAP unique identifier, backup image, data store,organization account, and/or the like. A user programs table 919 cincludes fields such as, but not limited to: system programs,organization programs, programs to be synchronized, and/or the like. Inone embodiment, user programs may contain various user interfaceprimitives, which may serve to update TCAPs. Also, various accounts mayrequire custom database tables depending upon the environments and thetypes of TCAPs a TCAPS may need to serve. It should be noted that anyunique fields may be designated as a key field throughout. In analternative embodiment, these tables have been decentralized into theirown databases and their respective database controllers (i.e.,individual database controllers for each of the above tables). Employingstandard data processing techniques, one may further distribute thedatabases over several computer systemizations and/or storage devices.Similarly, configurations of the decentralized database controllers maybe varied by consolidating and/or distributing the various databasemodules 919 a-c. The TCAPS may be configured to keep track of varioussettings, inputs, and parameters via database controllers.

A TCAPS database may communicate to and/or with other modules in amodule collection, including itself, and/or facilities of the like. Mostfrequently, the TCAPS database communicates with a TCAPS module, otherprogram modules, and/or the like. The database may contain, retain, andprovide information regarding other nodes and data.

Cryptographic Server

A cryptographic server module 920 is stored program code that isexecuted by the CPU 903, cryptographic processor 926, cryptographicprocessor interface 927, cryptographic processor device 928, and/or thelike. Cryptographic processor interfaces will allow for expedition ofencryption and/or decryption requests by the cryptographic module;however, the cryptographic module, alternatively, may run on aconventional CPU. The cryptographic module allows for the encryptionand/or decryption of provided data. The cryptographic module allows forboth symmetric and asymmetric (e.g., Pretty Good Protection (PGP))encryption and/or decryption. The cryptographic module may employcryptographic techniques such as, but not limited to: digitalcertificates (e.g., X.509 authentication framework), digital signatures,dual signatures, enveloping, password access protection, public keymanagement, and/or the like. The cryptographic module will facilitatenumerous (encryption and/or decryption) security protocols such as, butnot limited to: checksum, Data Encryption Standard (DES), EllipticalCurve Encryption (ECC), International Data Encryption Algorithm (IDEA),Message Digest 5 (MD5, which is a one way hash function), passwords,Rivest Cipher (RC5), Rijndael, RSA (which is an Internet encryption andauthentication system that uses an algorithm developed in 1977 by RonRivest, Adi Shamir, and Leonard Adleman), Secure Hash Algorithm (SHA),Secure Socket Layer (SSL), Secure Hypertext Transfer Protocol (HTTPS),and/or the like. Employing such encryption security protocols, the TCAPSmay encrypt all incoming and/or outgoing communications and may serve asnode within a virtual private network (VPN) with a wider communicationsnetwork. The cryptographic module facilitates the process of “securityauthorization” whereby access to a resource is inhibited by a securityprotocol wherein the cryptographic module effects authorized access tothe secured resource. In addition, the cryptographic module may provideunique identifiers of content, e.g., employing and MD5 hash to obtain aunique signature for an digital audio file. A cryptographic module maycommunicate to and/or with other modules in a module collection,including itself, and/or facilities of the like. The cryptographicmodule supports encryption schemes allowing for the secure transmissionof information across a communications network to enable a TCAPS moduleto engage in secure transactions if so desired. The cryptographic modulefacilitates the secure accessing of resources on TCAPS and facilitatesthe access of secured resources on remote systems; i.e., it may act as aclient and/or server of secured resources. Most frequently, thecryptographic module communicates with information servers, operatingsystems, other program modules, and/or the like. The cryptographicmodule may contain, communicate, generate, obtain, and/or provideprogram module, system, user, and/or data communications, requests,and/or responses.

TCAPS

A TCAPS module 935 is stored program code that is executed by the CPU.The TCAPS affects accessing, obtaining and the provision of information,services, transactions, and/or the like across various communicationsnetworks. The TCAPS enables TCAP users to simply access data and/orservices across a communications network in a secure manner. The TCAPSextends the storage and processing capacities and capabilities of TCAPs.The TCAPS coordinates with the TCAPS database to identifyinterassociated items in the generation of entries regarding any relatedinformation. A TCAPS module enabling access of information between nodesmay be developed by employing standard development tools such as, butnot limited to: (ANSI) (Objective-) C (++), Apache modules, binaryexecutables, Java, Javascript, mapping tools, procedural and objectoriented development tools, PERL, Python, shell scripts, SQL commands,web application server extensions, WebObjects, and/or the like. In oneembodiment, the TCAPS server employs a cryptographic server to encryptand decrypt communications. A TCAPS module may communicate to and/orwith other modules in a module collection, including itself, and/orfacilities of the like. Most frequently, the TCAPS module communicateswith a TCAPS database, operating systems, other program modules, and/orthe like. The TCAPS may contain, communicate, generate, obtain, and/orprovide program module, system, user, and/or data communications,requests, and/or responses.

Distributed TCAP

The structure and/or operation of any of the TCAPS node controllercomponents may be combined, consolidated, and/or distributed in anynumber of ways to facilitate development and/or deployment. Similarly,the module collection may be combined in any number of ways tofacilitate deployment and/or development. To accomplish this, one mayintegrate the components into a common code base or in a facility thatcan dynamically load the components on demand in an integrated fashion.

The module collection may be consolidated and/or distributed incountless variations through standard data processing and/or developmenttechniques. Multiple instances of any one of the program modules in theprogram module collection may be instantiated on a single node, and/oracross numerous nodes to improve performance through load-balancingand/or data-processing techniques. Furthermore, single instances mayalso be distributed across multiple controllers and/or storage devices;e.g., databases. All program module instances and controllers working inconcert may do so through standard data processing communicationtechniques.

The configuration of the TCAPS controller will depend on the context ofsystem deployment. Factors such as, but not limited to, the budget,capacity, location, and/or use of the underlying hardware resources mayaffect deployment requirements and configuration. Regardless of if theconfiguration results in more consolidated and/or integrated programmodules, results in a more distributed series of program modules, and/orresults in some combination between a consolidated and distributedconfiguration, data may be communicated, obtained, and/or provided.Instances of modules consolidated into a common code base from theprogram module collection may communicate, obtain, and/or provide data.This may be accomplished through intra-application data processingcommunication techniques such as, but not limited to: data referencing(e.g., pointers), internal messaging, object instance variablecommunication, shared memory space, variable passing, and/or the like.

If module collection components are discrete, separate, and/or externalto one another, then communicating, obtaining, and/or providing datawith and/or to other module components may be accomplished throughinter-application data processing communication techniques such as, butnot limited to: Application Program Interfaces (API) informationpassage; (distributed) Component Object Model ((D)COM), (Distributed)Object Linking and Embedding ((D)OLE), and/or the like), Common ObjectRequest Broker Architecture (CORBA), process pipes, shared files, and/orthe like. Messages sent between discrete module components forinter-application communication or within memory spaces of a singularmodule for intra-application communication may be facilitated throughthe creation and parsing of a grammar. A grammar may be developed byusing standard development tools such as lex, yacc, and/or the like,which allow for grammar generation and parsing functionality, which inturn may form the basis of communication messages within and betweenmodules. Again, the configuration will depend upon the context of systemdeployment.

Tunneling Client Access Point Controller

FIG. 10 illustrates one embodiment incorporated into a tunneling clientaccess point (TCAP) controller 1001. Much of the description of theTCAPS of FIG. 9 applies to the TCAP, and as such, the disclosure focusesmore upon the variances exhibited in the TCAP. In this embodiment, theTCAP controller 1001 may serve to process, store, search, identify,instruct, generate, match, and/or update data within itself, at a TCAPS,and/or through an AT.

The first and foremost difference between the TCAP and the TCAPS is thatthe TCAP is very small as was shown 130 of FIG. 1. The TCAP may bepackaged in plugin sticks, often, smaller than the size of a humanthumb. In one embodiment, a TCAP may be hardened for military use. Insuch an embodiment, the shell 1001 may be composed of metal, and/orother durable composites. Also, components within may be shielded fromradiation.

In one embodiment, the TCAP controller 1001 may be connected to and/orcommunicate with entities such as, but not limited to: one or more usersfrom an access terminal 1011 b. The access terminal itself may beconnected to peripherals such as user input devices (e.g., keyboard 1012a, mouse 1012 b, etc.); and/or a communications network 1013 in mannersimilar to that described in FIG. 9.

A TCAP controller 1001 may be based on common computer systemscomponents that may comprise, but are not limited to, components suchas: a computer systemization 1002 connected to memory 1029. Optionally,the TCAP controller 1001 may convey information 1058, produce outputthrough an output device 1048, and obtain input from control device1018.

Control Device

The control device 1018 may be optionally provided to accept user inputto control access to the TCAP controller. In one embodiment, the controldevice may provide a keypad 1028. Such a keypad would allow the user toenter passwords, personal identification numbers (PIN), and/or the like.

In an alternative embodiment, the control device may include a securitydevice 1038. In one embodiment, the security device is a fingerprintintegrated circuit (fingerprint IC) that provides biometric fingerprintinformation such as, but not limited to AuthenTec Inc.'s FingerLoc™AF-S2™. Either a fingerprint IC and/or other biometric device willprovide biometric validation information that may be used to confirm theidentity of a TCAP user and ensure that transactions are legitimate. Inalternative embodiments, a simple button, heat sensor, and/or other typeof user input functionality may be provided solely and/or in concertwith other types of control device types. The control device may beconnected to the I/O interface, the system bus, or the CPU directly.

The output device 1048 is used to provide status information to theuser. In one alternative embodiment, the output device is an LCD panelcapable of providing alpha numeric and/or graphic displays. In analternative embodiment, the output device may be a speaker providingaudible signals indicating errors and/or actually streaming informationthat is audible to the user, such as voice alerts. The output device maybe connected to the I/O interface, the system bus, or the CPU directly.

The conveyance information 1058 component of the TCAP controller mayinclude any number of indicia representing the TCAP's source on thecover 1001. Source conveying indicia may include, but is not limited to:an owner name 1059 for readily verifying a TCAP user; a photo of theowner 1060 for readily verifying a TCAP controller owner; markdesignating the source that issued the TCAP 1061, 1001 such as acorporate logo, and/or the like; fanciful design information 1062 forenhancing the visual appearance of the TCAP; and/or the like. It shouldbe noted that the conveyance information 11421 may be positionedanywhere on the cover 1189.

Computer Systemization

A computer systemization 1002 may comprise a clock 1030, centralprocessing unit (CPU) 1003, a read only memory (ROM) 1006, a randomaccess memory (RAM) 1005, and/or an interface bus 1007, and mostfrequently, although not necessarily, are all interconnected and/orcommunicating through a system bus 1004. Optionally the computersystemization may be connected to an internal power source 1086.Optionally, a cryptographic processor 1026 may be connected to thesystem bus. The system clock typically has a crystal oscillator andprovides a base signal. Of course, any of the above components may beconnected directly to one another, connected to the CPU, and/ororganized in numerous variations employed as exemplified by variouscomputer systems.

The CPU comprises at least one low-power data processor adequate toexecute program modules for executing user and/or system-generatedrequests. The CPU may be a microprocessor such as ARM's ApplicationCores, Embedded Cores, Secure Cores; Motorola's DragonBall; and/or thelike processor(s).

Power Source

The power source 1086 may be of any standard form for powering smallelectronic circuit board devices such as but not limited to: alkaline,lithium hydride, lithium ion, nickel cadmium, solar cells, and/or thelike. In the case of solar cells, the case provides an aperture throughwhich the solar cell protrudes are to receive photonic energy. The powercell 1086 is connected to at least one of the interconnected subsequentcomponents of the TCAP thereby providing an electric current to allsubsequent components. In one example, the power cell 1086 is connectedto the system bus component 1004. In an alternative embodiment, anoutside power source 1086 is provided through a connection across theI/O 1008 interface. For example, a USB and/or IEEE 1394 connectioncarries both data and power across the connection and is therefore asuitable source of power.

Interface Adapters

Interface bus(ses) 1007 may accept, connect, and/or communicate to anumber of interface adapters, conventionally although not necessarily inthe form of adapter cards, such as but not limited to: input outputinterfaces (I/O) 1008, storage interfaces 1009, network interfaces 1010,and/or the like. Optionally, cryptographic processor interfaces 1027similarly may be connected to the interface bus. The interface busprovides for the communications of interface adapters with one anotheras well as with other components of the computer systemization.Interface adapters are adapted for a compatible interface bus. In oneembodiment, the interface bus provides I/O 1008 via a USB port. In analternative embodiment, the interface bus provides I/O via an IEEE 1394port. In an alternative embodiment, wireless transmitters are employedby interfacing wireless protocol integrated circuits (ICs) for I/O viathe interface bus 1007.

Storage interfaces 1009 may accept, communicate, and/or connect to anumber of storage devices such as, but not limited to: storage devices1014, removable disc devices, and/or the like. Storage interfaces mayemploy connection protocols such as, but not limited to a flash memoryconnector, and/or the like. In one embodiment, an optional networkinterface may be provide 1010.

Input Output interfaces (I/O) 1008 may accept, communicate, and/orconnect to an access terminal 1011 b. I/O may employ connectionprotocols such as, but not limited to: Apple Desktop Bus (ADB); AppleDesktop Connector (ADC); IEEE 1394a-b; infrared; PC AT; PS/2; parallel;radio; serial; USB, and/or the like; wireless component; and/or thelike.

Wireless Component

In one embodiment a wireless component may comprise a Bluetooth chipdisposed in communication with a transceiver 1043 and a memory 1029through the interface bus 1007 and/or system bus 1004. The transceivermay be either external to the Bluetooth chip, or integrated within theBluetooth chip itself. The transceiver is a radio frequency (RF)transceiver operating in the range as required for Bluetoothtransmissions. Further, the Bluetooth chip 1044 may integrate aninput/output interface (I/O) 1066. The Bluetooth chip and its I/O may beconfigured to interface with the TCAP controller through the interfacebus, the system bus, and/or directly with the CPU. The I/O may be usedto interface with other components such as an access terminal 1011 bequipped with similar wireless capabilities. In one embodiment, the TCAPmay optionally interconnect wirelessly with a peripheral device 912and/or a control device 911 of FIG. 9. In one example embodiment, theI/O may be based on serial line technologies, a universal serial bus(USB) protocol, and/or the like. In an alternative embodiment, the I/Omay be based on the ISO 7816-3 standard. It should be noted that theBluetooth chip in an alternative embodiment may be replaced with an IEEE802.11b wireless chip. In another embodiment, both a Bluetooth chip andan IEEE 802.11b wireless chip may be used to communicate and or bridgecommunications with respectively enabled devices. It should further benoted that the transceiver 1043 may be used to wirelessly communicatewith other devices powered by Bluetooth chips and/or IEEE 802.11b chipsand/or the like. The ROM can provide a basic instruction set enablingthe Bluetooth chip to use its I/O to communicate with other components.A number of Bluetooth chips are commercially available, and may be usedas a Bluetooth chip in the wireless component, such as, but not limitedto, CSR's BlueCore line of chips. If IEEE 802.11b functionality isrequired, a number of chips are commercially available for the wirelesscomponent as well.

Cryptographic units such as, but not limited to, microcontrollers,processors 1026, and/or interfaces 1027 may be attached, and/orcommunicate with the TCAP controller. A Secure Core component commonlymanufactured by ARM, Inc. and may be used for and/or withincryptographic units.

Memory

Generally, any mechanization and/or embodiment allowing a processor toaffect the storage and/or retrieval of information is regarded as memory1029. However, memory is a fungible technology and resource, thus, anynumber of memory embodiments may be employed in lieu of or in concertwith one another. It is to be understood that a TCAP controller and/or acomputer systemization may employ various forms of memory 1029. In atypical configuration, memory 1029 will include ROM 1006, RAM 1005, anda storage device 1014. A storage device 1014 may be any conventionalcomputer system storage. Storage devices may include flash memory, microhard drives, and/or the like.

Module Collection

The memory 1029 may contain a collection of program and/or databasemodules and/or data such as, but not limited to: operating systemmodule(s) 1015 (operating system); information server module(s) 1016(information server); user interface module(s) 1017 (user interface);Web browser module(s) 1018 (Web browser); database(s) 1019;cryptographic server module(s) 1020 (cryptographic server); accessterminal module 1021; TCAP module(s) 1035; and/or the like (i.e.,collectively a module collection). These modules may be stored andaccessed from the storage devices and/or from storage devices accessiblethrough an interface bus. Although non-conventional software modulessuch as those in the module collection, typically, are stored in a localstorage device 1014, they may also be loaded and/or stored in memorysuch as: peripheral devices, RAM, remote storage facilities through anaccess terminal, communications network, ROM, various forms of memory,and/or the like. In one embodiment, all data stored in memory isencrypted by employing the cryptographic server 1020 as described infurther detail below. In one embodiment, the ROM contains a unique TCAPidentifier. For example, the TCAP may contain a unique digitalcertificate, number, and/or the like, which may be used for purposes ofverification and encryption across a network and/or in conjunction witha TCAPS.

Operating System

The operating system module 1015 is executable program code facilitatingthe operation of a TCAP controller. Typically, the operating systemfacilitates access of I/O, network interfaces, peripheral devices,storage devices, and/or the like. The operating system may be a highlyfault tolerant, scalable, and secure system such as Linux, and/or thelike operating systems. However, more limited and/or less secureoperating systems also may be employed such as Java runtime OS, and/orthe like. An operating system may communicate to and/or with othermodules in a module collection, including itself, and/or the like. Mostfrequently, the operating system communicates with other programmodules, user interfaces, and/or the like. For example, the operatingsystem may contain, communicate, generate, obtain, and/or provideprogram module, system, user, and/or data communications, requests,and/or responses. The operating system, once executed by the CPU, mayenable the interaction with an access terminal, communications networks,data, I/O, peripheral devices, program modules, memory, user inputdevices, and/or the like. The operating system may providecommunications protocols that allow the TCAP controller to communicatewith other entities through an access terminal. Various communicationprotocols may be used by the TCAP controller as a subcarrier transportmechanism for interaction, such as, but not limited to: TCP/IP, USB,and/or the like.

Information Server

An information server module 1016 is stored program code that isexecuted by the CPU. The information server may be a conventionalInternet information server such as, but not limited to Apache SoftwareFoundation's Apache, and/or the like. The information server may allowfor the execution of program modules through facilities such as ActiveServer Page (ASP), ActiveX, (ANSI) (Objective-) C (++), Common GatewayInterface (CGI) scripts, Java, JavaScript, Practical Extraction ReportLanguage (PERL), Python, WebObjects, and/or the like. The informationserver may support secure communications protocols such as, but notlimited to, File Transfer Protocol (FTP); HyperText Transfer Protocol(HTTP); Secure Hypertext Transfer Protocol (HTTPS), Secure Socket Layer(SSL), and/or the like. The information server provides results in theform of Web pages to Web browsers, and allows for the manipulatedgeneration of the Web pages through interaction with other programmodules. An information server may communicate to and/or with othermodules in a module collection, including itself, and/or facilities ofthe like. Most frequently, the information server communicates with theTCAP database 1019, operating systems, other program modules, userinterfaces, Web browsers, and/or the like.

Access to TCAP database may be achieved through a number of databasebridge mechanisms such as through scripting languages as enumeratedbelow (e.g., CGI) and through inter-application communication channelsas enumerated below (e.g., CORBA, WebObjects, etc.). Any data requeststhrough a Web browser are parsed through the bridge mechanism intoappropriate grammars as required by the TCAP. In one embodiment, theinformation server would provide a Web form accessible by a Web browser.Entries made into supplied fields in the Web form are tagged as havingbeen entered into the particular fields, and parsed as such. The enteredterms are then passed along with the field tags, which act to instructthe parser to generate queries directed to appropriate tables and/orfields. In one embodiment, the parser may generate queries in standardSQL by instantiating a search string with the proper join/selectcommands based on the tagged text entries, wherein the resulting commandis provided over the bridge mechanism to the TCAP as a query. Upongenerating query results from the query, the results are passed over thebridge mechanism, and may be parsed for formatting and generation of anew results Web page by the bridge mechanism. Such a new results Webpage is then provided to the information server, which may supply it tothe requesting Web browser.

Also, an information server may contain, communicate, generate, obtain,and/or provide program module, system, user, and/or data communications,requests, and/or responses.

User Interface

A user interface module 1017 is stored program code that is executed bythe CPU. The user interface may be a conventional graphic user interfaceas provided by, with, and/or atop operating systems and/or operatingenvironments such as Apple Macintosh OS, e.g., Aqua, Microsoft Windows(NT/XP), Unix X Windows (KDE, Gnome, and/or the like), and/or the like.The TCAP may employ code natively compiled for various operatingsystems, or code compiled using Java. The user interface may allow forthe display, execution, interaction, manipulation, and/or operation ofprogram modules and/or system facilities through textual and/orgraphical facilities. The user interface provides a facility throughwhich users may affect, interact, and/or operate a computer system. Auser interface may communicate to and/or with other modules in a modulecollection, including itself, and/or facilities of the like. Mostfrequently, the user interface communicates with operating systems,other program modules, and/or the like. The user interface may contain,communicate, generate, obtain, and/or provide program module, system,user, and/or data communications, requests, and/or responses.

Web Browser

A Web browser module 1018 is stored program code that is executed by theCPU. A small-scale embedded Web browser may allow the TCAP to access andcommunicate with an attached access terminal, and beyond across acommunications network. An example browser is Blazer, Opera, FireFox,etc. A browsing module may contain, communicate, generate, obtain,and/or provide program module, system, user, and/or data communications,requests, and/or responses. Of course, in place of a Web browser andinformation server, a combined application may be developed to performsimilar functions of both. The combined application would similarlyaffect the obtaining and the provision of information to users, useragents, and/or the like from TCAP enabled nodes. The combinedapplication may be nugatory on systems employing standard Web browsers.

TCAP Database

A TCAP database module 1019 may be embodied in a database and its storeddata. The database is stored program code, which is executed by the CPU;the stored program code portion configuring the CPU to process thestored data. In one embodiment, the TCAP database may be implementedusing various standard data-structures, such as an array, hash, (linked)list, struct, structured text file (e.g., XML), table, and/or the like.Such data-structures may be stored in memory and/or in (structured)files. If the TCAP database is implemented as a data-structure, the useof the TCAP database may be integrated into another module such as theTCAP module. Databases may be consolidated and/or distributed incountless variations through standard data processing techniques.Portions of databases, e.g., tables, may be exported and/or imported andthus decentralized and/or integrated. In one embodiment, the databasemodule 1019 includes three tables 1019 a-c. A user accounts table 1019 aincludes fields such as, but not limited to: a user name, user address,user authorization information (e.g., user name, password, biometricdata, etc.), user credit card, organization, organization account, TCAPunique identifier, account creation data, account expiration date;and/or the like. In one embodiment, user accounts may be activated onlyfor set amounts of time and will then expire once a specified date hasbeen reached. An user data table 1019 b includes fields such as, but notlimited to: a TCAP unique identifier, backup image, data store,organization account, and/or the like. In one embodiment, the entireTCAP memory 1029 is processes into an image and spooled to a TCAPS forbackup storage. A user programs table 1019 c includes fields such as,but not limited to: system programs, organization programs, programs tobe synchronized, and/or the like. It should be noted that any uniquefields may be designated as a key field throughout. In an alternativeembodiment, these tables have been decentralized into their owndatabases and their respective database controllers (i.e., individualdatabase controllers for each of the above tables). Employing standarddata processing techniques, one may further distribute the databasesover several computer systemizations and/or storage devices. Similarly,configurations of the decentralized database controllers may be variedby consolidating and/or distributing the various database modules 1019a-c. The TCAP may be configured to keep track of various settings,inputs, and parameters via database controllers.

A TCAP database may communicate to and/or with other modules in a modulecollection, including itself, and/or facilities of the like. Mostfrequently, the TCAP database communicates with a TCAP module, otherprogram modules, and/or the like. The database may contain, retain, andprovide information regarding other nodes and data.

Cryptographic Server

A cryptographic server module 1020 is stored program code that isexecuted by the CPU 1003, cryptographic processor 1026, cryptographicprocessor interface 1027, and/or the like. Cryptographic processorinterfaces will allow for expedition of encryption and/or decryptionrequests by the cryptographic module; however, the cryptographic module,alternatively, may run on a conventional CPU. The cryptographic moduleallows for the encryption and/or decryption of provided data. Thecryptographic module allows for both symmetric and asymmetric (e.g.,Pretty Good Protection (PGP)) encryption and/or decryption. Thecryptographic module may employ cryptographic techniques such as, butnot limited to: digital certificates (e.g., X.509 authenticationframework), digital signatures, dual signatures, enveloping, passwordaccess protection, public key management, and/or the like. Thecryptographic module will facilitate numerous (encryption and/ordecryption) security protocols such as, but not limited to: checksum,Data Encryption Standard (DES), Elliptical Curve Encryption (ECC),International Data Encryption Algorithm (IDEA), Message Digest 5 (MD5,which is a one way hash function), passwords, Rivest Cipher (RC5),Rijndael, RSA (which is an Internet encryption and authentication systemthat uses an algorithm developed in 1977 by Ron Rivest, Adi Shamir, andLeonard Adleman), Secure Hash Algorithm (SHA), Secure Socket Layer(SSL), Secure Hypertext Transfer Protocol (HTTPS), and/or the like. Thecryptographic module facilitates the process of “security authorization”whereby access to a resource is inhibited by a security protocol whereinthe cryptographic module effects authorized access to the securedresource. In addition, the cryptographic module may provide uniqueidentifiers of content, e.g., employing and MD5 hash to obtain a uniquesignature for an digital audio file. A cryptographic module maycommunicate to and/or with other modules in a module collection,including itself, and/or facilities of the like. The cryptographicmodule supports encryption schemes allowing for the secure transmissionof information across a communications network to enable a TCAP moduleto engage in secure transactions if so desired. The cryptographic modulefacilitates the secure accessing of resources on TCAP and facilitatesthe access of secured resources on remote systems; i.e., it may act as aclient and/or server of secured resources. Most frequently, thecryptographic module communicates with information servers, operatingsystems, other program modules, and/or the like. The cryptographicmodule may contain, communicate, generate, obtain, and/or provideprogram module, system, user, and/or data communications, requests,and/or responses. In one embodiment, the TCAP employs the cryptographicserver to encrypt all data stored in memory 1029 based on the TCAP'sunique ID and user's authorization information. In another embodiment,the TCAP employs the cryptographic server to encrypt all data sentthrough the access terminal based in the TCAP's unique ID and user'sauthorization information.

TCAP

A TCAP module 1035 is stored program code that is executed by the CPU.The TCAP affects accessing, obtaining and the provision of information,services, storage, transactions, and/or the like within its memoryand/or across various communications networks. The TCAP enables users tosimply access data and/or services from any location where an accessterminal is available. It provides secure, extremely low powerful andultra portable access to data and services that were heretoforeimpossible. The TCAP coordinates with the TCAP database to identifyinterassociated items in the generation of entries regarding any relatedinformation. A TCAP module enabling access of information between nodesmay be developed by employing standard development tools such as, butnot limited to: (ANSI) (Objective-) C (++), Apache modules, binaryexecutables, Java, Javascript, mapping tools, procedural and objectoriented development tools, PERL, Python, shell scripts, SQL commands,web application server extensions, WebObjects, and/or the like. In oneembodiment, the TCAP server employs a cryptographic server to encryptand decrypt communications. A TCAP module may communicate to and/or withother modules in a module collection, including itself, and/orfacilities of the like. Most frequently, the TCAP module communicateswith a TCAP database, a TCAP access terminal module 1021 running on anaccess terminal 1011 b, operating systems, other program modules, and/orthe like. The TCAP may contain, communicate, generate, obtain, and/orprovide program module, system, user, and/or data communications,requests, and/or responses.

Access Terminal Module

An access terminal module 1021 is stored program code that is executedby a CPU. In one embodiment, the TCAP allows the access terminal 1011 bto access its memory 1029 across its I/O 1008 and the access terminalexecutes the module. The access terminal module affects accessing,obtaining and the provision of information, services, storage,transactions, and/or the like within the TCAP's and access terminal'smemory and/or across various communications networks. The accessterminal module 1021 acts as a bridge through which the TCAP cancommunicate with communications network, and through which users mayinteract with the TCAP by using the I/O of the access terminal. Theaccess terminal module coordinates with the TCAP module 1035 to senddata and communications back and forth. A access terminal moduleenabling access of information between the TCAP and access terminal maybe developed by employing standard development tools such as, but notlimited to: (ANSI) (Objective-) C (++), Apache modules, binaryexecutables, Java, Javascript, mapping tools, procedural and objectoriented development tools, PERL, Python, shell scripts, SQL commands,web application server extensions, WebObjects, and/or the like. In oneembodiment, the access terminal module is compiled for target accessterminal platform, e.g., for Windows. In an alternative embodiment, aprocessor independent approach is taken, e.g., Java is used, so that theaccess terminal module will run on multiple platforms. In anotherembodiment, the TCAP server employs a cryptographic server to encryptand decrypt communications as between it, the TCAP, and outside servers.A access terminal module may communicate to and/or with other modules ina module collection, including itself, and/or facilities of the like.Most frequently, the access terminal module communicates with a TCAP,other program modules, and/or the like. The access terminal module maycontain, communicate, generate, obtain, and/or provide program module,system, user, and/or data communications, requests, and/or responses.

Distributed TCAP

The structure and/or operation of any of the TCAP node controllercomponents may be combined, consolidated, and/or distributed in anynumber of ways to facilitate development and/or deployment. Similarly,the module collection may be combined in any number of ways tofacilitate deployment and/or development. To accomplish this, one mayintegrate the components into a common code base or in a facility thatcan dynamically load the components on demand in an integrated fashion.

The module collection may be consolidated and/or distributed incountless variations through standard data processing and/or developmenttechniques. Multiple instances of any one of the program modules in theprogram module collection may be instantiated on a single node, and/oracross numerous nodes to improve performance through load-balancingand/or data-processing techniques. Furthermore, single instances mayalso be distributed across multiple controllers and/or storage devices;e.g., databases. All program module instances and controllers working inconcert may do so through standard data processing communicationtechniques.

The configuration of the TCAP controller will depend on the context ofsystem deployment. Factors such as, but not limited to, the budget,capacity, location, and/or use of the underlying hardware resources mayaffect deployment requirements and configuration. Regardless of if theconfiguration results in more consolidated and/or integrated programmodules, results in a more distributed series of program modules, and/orresults in some combination between a consolidated and distributedconfiguration, data may be communicated, obtained, and/or provided.Instances of modules consolidated into a common code base from theprogram module collection may communicate, obtain, and/or provide data.This may be accomplished through intra-application data processingcommunication techniques such as, but not limited to: data referencing(e.g., pointers), internal messaging, object instance variablecommunication, shared memory space, variable passing, and/or the like.

If module collection components are discrete, separate, and/or externalto one another, then communicating, obtaining, and/or providing datawith and/or to other module components may be accomplished throughinter-application data processing communication techniques such as, butnot limited to: Application Program Interfaces (API) informationpassage; (distributed) Component Object Model ((D)COM), (Distributed)Object Linking and Embedding ((D)OLE), and/or the like), Common ObjectRequest Broker Architecture (CORBA), process pipes, shared files, and/orthe like. Messages sent between discrete module components forinter-application communication or within memory spaces of a singularmodule for intra-application communication may be facilitated throughthe creation and parsing of a grammar. A grammar may be developed byusing standard development tools such as lex, yacc, and/or the like,which allow for grammar generation and parsing functionality, which inturn may form the basis of communication messages within and betweenmodules. Again, the configuration will depend upon the context of systemdeployment.

The entirety of this disclosure (including the Cover Page, Title,Headings, Field, Background, Summary, Brief Description of the Drawings,Detailed Description, Claims, Abstract, Figures, and otherwise) shows byway of illustration various embodiments in which the claimed inventionsmay be practiced. The advantages and features of the disclosure are of arepresentative sample of embodiments only, and are not exhaustive and/orexclusive. They are presented only to assist in understanding and teachthe claimed principles. It should be understood that they are notrepresentative of all claimed inventions. As such, certain aspects ofthe disclosure have not been discussed herein. That alternateembodiments may not have been presented for a specific portion of theinvention or that further undescribed alternate embodiments may beavailable for a portion is not to be considered a disclaimer of thosealternate embodiments. It will be appreciated that many of thoseundescribed embodiments incorporate the same principles of the inventionand others are equivalent. Thus, it is to be understood that otherembodiments may be utilized and functional, logical, organizational,structural and/or topological modifications may be made withoutdeparting from the scope and/or spirit of the disclosure. As such, allexamples and/or embodiments are deemed to be non-limiting throughoutthis disclosure. Also, no inference should be drawn regarding thoseembodiments discussed herein relative to those not discussed hereinother than for purposes of space and reducing repetition. For instance,it is to be understood that the logical and/or topological structure ofany combination of any program modules (a module collection), othercomponents and/or any present feature sets as described in the figuresand/or throughout are not limited to a fixed operating order and/orarrangement, but rather, any disclosed order is exemplary and allequivalents, regardless of order, are contemplated by the disclosure.Furthermore, it is to be understood that such features are not limitedto serial execution, but rather, any number of threads, processes,services, servers, and/or the like that may execute asynchronously,simultaneously, synchronously, and/or the like are contemplated by thedisclosure. As such, some of these features may be mutuallycontradictory, in that they cannot be simultaneously present in a singleembodiment. Similarly, some features are applicable to one aspect of theinvention, and inapplicable to others. In addition, the disclosureincludes other inventions not presently claimed. Applicant reserves allrights in those presently unclaimed inventions including the right toclaim such inventions, file additional applications, continuations,continuations in part, divisions, and/or the like thereof. As such, itshould be understood that advantages, embodiments, examples, functional,features, logical, organizational, structural, topological, and/or otheraspects of the disclosure are not to be considered limitations on thedisclosure as defined by the claims or limitations on equivalents to theclaims.

1: A portable device, comprising: (a) an external communicationsinterface configured to enable the transmission of a plurality ofcommunications between the portable device and a terminal comprising aterminal processor, a first input component, a first output component,and a network interface; (b) a processor; and (c) a memory having aplurality of processing instructions stored thereon, including: (1) afirst set of processing instructions, which when executed by theterminal processor, enables a user to employ the first input componentand the first output component to interact with the portable device andprovides the portable device with access to the terminal networkinterface; (2) at least one processing instruction, which when executed,causes an interactive user interface to be presented on the first outputcomponent, wherein the interactive user interface is configured toenable the user to cause the portable device processor to execute a setof processing instructions stored on the portable device memory; and (3)a second set of processing instructions, which when executed by theportable device processor in response to user interaction with theinteractive user interface, causes the portable device to transmit acommunication to a communication network node; wherein the portabledevice is configured to effect the display of processing activity of thesecond set of processing instructions on the first output component; andwherein the portable device is configured to communicate with theterminal and to communicate through the terminal network interface withthe communication network node. 2: The portable device of claim 1,wherein the external communication interface is a universal serial businterface. 3: The portable device of claim 1, wherein the externalcommunication interface is a wireless communication interface. 4: Theportable device of claim 3, wherein the wireless communication interfaceemploys Bluetooth connectivity protocol. 5: The portable device of claim3, wherein the wireless communication interface employs WiFiconnectivity protocol. 6: The portable device of claim 1, wherein thedevice memory comprises one or more of the group consisting of flashmemory, read only memory, random access memory, micro hard drives andthe like. 7: The portable device of claim 1, wherein the communicationnetwork comprises a local area network. 8: The portable device of claim7, wherein the communication network node comprises a server. 9: Theportable device of claim 7, wherein the communication network nodecomprises a data storage system. 10: The portable device of claim 9,wherein the data storage system comprises a redundant array ofindependent disks. 11: The portable device of claim 7, wherein thecommunication network node comprises a printer. 12: The portable deviceof claim 7, wherein the communication network comprises a wireless localarea network. 13: The portable device of claim 1, wherein thecommunication network comprises a wide area network. 14: The portabledevice of claim 1, wherein the communication network comprises theInternet. 15: The portable device of claim 14, wherein the communicationnetwork node comprises a server. 16: The portable device of claim 14,wherein the communication network node comprises a data storage system.17: The portable device of claim 16, wherein the data storage systemcomprises a redundant array of independent disks. 18: The portabledevice of claim 14, wherein the communication network node comprises anintermediary node. 19: The portable device of claim 18, wherein theintermediary node comprises a router. 20: The portable device of claim1, wherein the communication network comprises a wireless network. 21:The portable device of 1, wherein the at least one processinginstruction, which when executed causes the interactive user interfaceto be presented on the first output component, comprises a third set ofprocessing instructions. 22: The portable device of claim 21, whereinthe third set of processing instructions is configured to be executed bythe portable device processor. 23: The portable device of claim 21,wherein the third set of processing instructions is configured to beexecuted by the terminal processor. 24: The portable device of claim 1,wherein the first output component comprises a display device. 25: Amethod implemented on a portable device comprising a processor, a memoryhaving a plurality of processing instructions stored thereon, and anexternal communications interface for enabling the transmission of aplurality of communications between the portable device and a terminalcomprising a terminal processor, a first input component, a first outputcomponent, and a network interface, the method comprising: (a) providingthe terminal with access to a first set of processing instructionsstored on the portable device memory, which when executed by theterminal processor, enables a user to employ the first input componentand the first output component to interact with the portable device andprovides the portable device with access to the terminal networkinterface; (b) executing at least one processing instruction stored onthe portable device memory to cause an interactive user interface to bepresented on the first output component, wherein the interactive userinterface is configured to enable the user to cause the portable deviceprocessor to execute a second set of processing instructions stored onthe portable device memory; (c) executing a second set of processinginstructions stored on the portable device memory in response to userinteraction with the interactive user interface; (d) transmitting acommunication to a communication network node; and (e) effecting thedisplay of processing activity of the second set of processinginstructions on the first output component. 26: The method of claim 25,wherein the at least one processing instruction stored on the portabledevice memory to cause an interactive user interface to be presented onthe first output component comprises a third set of processinginstructions stored on the portable device memory. 27: The method ofclaim 26, further comprising executing the third set of processinginstructions on the portable device processor. 28: The method of claim26, further comprising executing the third set of processinginstructions on the terminal processor. 29: A method implemented on aportable device comprising a processor, a memory having a plurality ofprocessing instructions stored thereon, and an external communicationsinterface for enabling the transmission of a plurality of communicationsbetween the portable device and a terminal comprising a terminalprocessor, a first input component, a first output component, and anetwork interface, the method comprising: (a) providing the terminalwith access to a first set of processing instructions stored on theportable device memory, which when executed by the terminal processor,enables a user to employ the first input component and the first outputcomponent to interact with the portable device and provides the portabledevice with access to the terminal network interface; (b) providing theterminal with access to a second set of processing instructions storedon the portable device memory, which when executed by the terminalprocessor, causes an interactive user interface to be presented on thefirst output component, wherein the interactive user interface isconfigured to enable the user to cause the portable device processor toexecute a third set of processing instructions stored on the portabledevice memory; (c) executing a third set of processing instructionsstored on the portable device memory in response to user interactionwith the interactive user interface; (d) transmitting a communication toa communication network node; and (e) effecting the display ofprocessing activity of the third set of processing instructions on thefirst output component. 30: A non-transitory computer readable mediumcontaining a plurality of processing instructions to be executed by acomputer system comprising a portable device and a terminal, theportable device comprising an external communications interface forenabling the transmission of a plurality of communications between theportable device and the terminal, a processor and a memory, and theterminal comprising a terminal processor, a first input component, afirst output component, and a network interface, the plurality ofprocessing instructions comprising: (a) a first set of processinginstructions, which when executed by the terminal processor, enables auser to employ the first input component and the first output componentto interact with the portable device and provides the portable devicewith access to the terminal network interface; (b) at least oneprocessing instructions, which when executed, causes an interactive userinterface to be presented on the first output component, wherein theinteractive user interface is configured to enable the user to cause theportable device processor to execute a set of processing instructionsstored on the portable device memory; and (c) a second set of processinginstructions, which when executed by the portable device processor inresponse to user interaction with the interactive user interface, causesthe portable device to transmit a communication to a communicationnetwork node. 31: The non-transitory computer readable medium of claim30, wherein the at least one processing instruction, which when executedcauses an interactive user interface to be presented on the first outputcomponent comprises a third set of processing instructions. 32: Thenon-transitory computer readable medium of claim 31, wherein the thirdset of processing instructions is configured to be executed by theportable device processor. 33: The non-transitory computer readablemedium of claim 31, wherein the third set of processing instructions isconfigured to be executed by the terminal processor. 34: A systemimplementing a terminal having a terminal processor, a first inputdevice, a first output device, and a network interface, the systemcomprising: (a) a communication network node; and (b) a portable devicecomprising an external communication interface for enabling thetransmission of a plurality of communications between the portabledevice and the terminal, a processor and a memory, wherein the memoryhas a plurality of processing instructions stored thereon, the portabledevice configured to: (1) provide the terminal with access to a firstset of processing instructions stored on the portable device memory,which when executed by the terminal processor, enables a user to employthe first input component and the first output component to interactwith the portable device and provides the portable device with access tothe terminal network interface; (2) execute at least one processinginstruction stored on the portable device memory to cause an interactiveuser interface to be presented on the first output component, whereinthe interactive user interface is configured to enable the user to causethe portable device processor to execute a second set of processinginstructions stored on the portable device memory; (3) execute a secondset of processing instructions stored on the portable device memory inresponse to user interaction with the interactive user interface; (4)transmit a communication to the communication network node; and (5)effect the display of processing activity of the second set ofprocessing instructions on the first output component. 35: The system ofclaim 34, wherein the at least one processing instruction, which whenexecuted causes an interactive user interface to be presented on thefirst output component, comprises a third set of processinginstructions. 36: The system of claim 35, wherein the portable device isconfigured to provide the terminal with access to the third set ofprocessing instructions. 37: The system of claim 35, wherein theportable device is configured to execute the third set of processinginstructions.